(a) General. If you are an establishment that performs any step in the manufacture of HCT/Ps, you must establish and maintain a quality program intended to prevent the introduction, transmission, or spread of communicable diseases through the manufacture and use of HCT/Ps. The quality program must be appropriate for the specific HCT/Ps manufactured and the manufacturing steps performed. The quality program must address all core CGTP requirements listed in § 1271.150(b).

(b) Functions. Functions of the quality program must include:

(1) Establishing and maintaining appropriate procedures relating to core CGTP requirements, and ensuring compliance with the requirements of § 1271.180 with respect to such procedures, including review, approval, and revision;

(2) Ensuring that procedures exist for receiving, investigating, evaluating, and documenting information relating to core CGTP requirements, including complaints, and for sharing any information pertaining to the possible contamination of the HCT/P or the potential for transmission of a communicable disease by the HCT/P with the following:

(i) Other establishments that are known to have recovered HCT/Ps from the same donor;

(ii) Other establishments that are known to have performed manufacturing steps with respect to the same HCT/P; and

(iii) Relating to consignees, in the case of such information received after the HCT/P is made available for distribution, shipped to the consignee, or administered to the recipient, procedures must include provisions for assessing risk and appropriate followup, and evaluating the effect this information has on the HCT/P and for the notification of all entities to whom the affected HCT/P was distributed, the quarantine and recall of the HCT/P, and/or reporting to FDA, as necessary.

(3) Ensuring that appropriate corrective actions relating to core CGTP requirements, including reaudits of deficiencies, are taken and documented, as necessary. You must verify corrective actions to ensure that such actions are effective and are in compliance with CGTP. Where appropriate, corrective actions must include both short-term action to address the immediate problem and long-term action to prevent the problem's recurrence. Documentation of corrective actions must include, where appropriate:

(i) Identification of the HCT/P affected and a description of its disposition;

(ii) The nature of the problem requiring corrective action;

(iii) A description of the corrective action taken; and

(iv) The date(s) of the corrective action.

(4) Ensuring the proper training and education of personnel involved in activities related to core CGTP requirements;

(5) Establishing and maintaining appropriate monitoring systems as necessary to comply with the requirements of this subpart (e.g., environmental monitoring);

(6) Investigating and documenting HCT/P deviations and trends of HCT/P deviations relating to core CGTP requirements and making reports if required under § 1271.350(b) or other applicable regulations. Each investigation must include a review and evaluation of the HCT/P deviation, the efforts made to determine the cause, and the implementation of corrective action(s) to address the HCT/P deviation and prevent recurrence.

(c) Audits. You must periodically perform for management review a quality audit, as defined in § 1271.3(gg), of activities related to core CGTP requirements.

(d) Computers. You must validate the performance of computer software for the intended use, and the performance of any changes to that software for the intended use, if you rely upon the software to comply with core CGTP requirements and if the software either is custom software or is commercially available software that has been customized or programmed (including software programmed to perform a user defined calculation or table) to perform a function related to core CGTP requirements. You must verify the performance of all other software for the intended use if you rely upon it to comply with core CGTP requirements. You must approve and document these activities and results before implementation.